|
|
@ -8,12 +8,38 @@ |
|
|
|
-- - A single behaviour is specified for each case in the specification. |
|
|
|
-- - A single behaviour is specified for each case in the specification. |
|
|
|
-- - There is a behaviour is specified for every case in the specification. |
|
|
|
-- - There is a behaviour is specified for every case in the specification. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
with Types; use Types; |
|
|
|
|
|
|
|
with External; |
|
|
|
|
|
|
|
with MMS.F_PT.F_MM.Output; |
|
|
|
|
|
|
|
|
|
|
|
package MMS.F_PT.F_MM.Behavior with |
|
|
|
package MMS.F_PT.F_MM.Behavior with |
|
|
|
SPARK_Mode, |
|
|
|
SPARK_Mode, |
|
|
|
Abstract_State => State |
|
|
|
Abstract_State => State |
|
|
|
is |
|
|
|
is |
|
|
|
pragma Unevaluated_Use_Of_Old (Allow); |
|
|
|
pragma Unevaluated_Use_Of_Old (Allow); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
------------ |
|
|
|
|
|
|
|
-- Inputs -- |
|
|
|
|
|
|
|
------------ |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
function Navigation_Mode_From_CP return Navigation_Mode_Type with |
|
|
|
|
|
|
|
Global => State; |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
function Navigation_Mode_From_GS return Navigation_Mode_Type with |
|
|
|
|
|
|
|
Global => State; |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
function Operating_Point_From_GS_Received return Boolean with |
|
|
|
|
|
|
|
Global => State; |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
function Operating_Point_From_GS return Operating_Point_Type with |
|
|
|
|
|
|
|
Global => State; |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
function USB_Key_Present return Boolean with |
|
|
|
|
|
|
|
Global => State; |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
function Operating_Point_From_USB_Key return Operating_Point_Type with |
|
|
|
|
|
|
|
Global => State; |
|
|
|
|
|
|
|
|
|
|
|
----------------------------------------- |
|
|
|
----------------------------------------- |
|
|
|
-- States of the automaton in Figure 3 -- |
|
|
|
-- States of the automaton in Figure 3 -- |
|
|
|
----------------------------------------- |
|
|
|
----------------------------------------- |
|
|
@ -36,7 +62,10 @@ is |
|
|
|
Pre => Power_State = ON |
|
|
|
Pre => Power_State = ON |
|
|
|
and then On_State = RUNNING; |
|
|
|
and then On_State = RUNNING; |
|
|
|
|
|
|
|
|
|
|
|
function Navigation_Mode return Navigation_Mode_Type with |
|
|
|
function Navigation_Mode return Navigation_Mode_Type |
|
|
|
|
|
|
|
is (if Navigation_Mode_From_CP = A then A |
|
|
|
|
|
|
|
else Navigation_Mode_From_GS) |
|
|
|
|
|
|
|
with |
|
|
|
Global => State, |
|
|
|
Global => State, |
|
|
|
Pre => Power_State = ON |
|
|
|
Pre => Power_State = ON |
|
|
|
and then On_State in INIT | RUNNING; |
|
|
|
and then On_State in INIT | RUNNING; |
|
|
@ -95,7 +124,7 @@ is |
|
|
|
and then On_State = RUNNING |
|
|
|
and then On_State = RUNNING |
|
|
|
and then Running_State = LANDING; |
|
|
|
and then Running_State = LANDING; |
|
|
|
|
|
|
|
|
|
|
|
function Operating_Mode_Changed return Boolean with |
|
|
|
function Operating_Point_Changed return Boolean with |
|
|
|
Global => State, |
|
|
|
Global => State, |
|
|
|
Pre => Power_State = ON |
|
|
|
Pre => Power_State = ON |
|
|
|
and then On_State = RUNNING |
|
|
|
and then On_State = RUNNING |
|
|
@ -118,7 +147,11 @@ is |
|
|
|
and then On_State in INIT | RUNNING |
|
|
|
and then On_State in INIT | RUNNING |
|
|
|
and then (if On_State = RUNNING then Running_State = CRUISE); |
|
|
|
and then (if On_State = RUNNING then Running_State = CRUISE); |
|
|
|
|
|
|
|
|
|
|
|
function Mission_Parameters_Defined return Boolean with |
|
|
|
function Mission_Parameters_Defined return Boolean is |
|
|
|
|
|
|
|
(USB_Key_Present |
|
|
|
|
|
|
|
or else (Navigation_Mode_From_CP = RP |
|
|
|
|
|
|
|
and then Operating_Point_From_GS_Received)) |
|
|
|
|
|
|
|
with |
|
|
|
Global => State, |
|
|
|
Global => State, |
|
|
|
Pre => Power_State = ON |
|
|
|
Pre => Power_State = ON |
|
|
|
and then On_State = INIT; |
|
|
|
and then On_State = INIT; |
|
|
@ -133,6 +166,10 @@ is |
|
|
|
Pre => Power_State = ON |
|
|
|
Pre => Power_State = ON |
|
|
|
and then On_State = CANCELLED; |
|
|
|
and then On_State = CANCELLED; |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
------------- |
|
|
|
|
|
|
|
-- Outputs -- |
|
|
|
|
|
|
|
------------- |
|
|
|
|
|
|
|
|
|
|
|
function Mission_Cancellation_Signaled return Boolean with |
|
|
|
function Mission_Cancellation_Signaled return Boolean with |
|
|
|
Global => State; |
|
|
|
Global => State; |
|
|
|
|
|
|
|
|
|
|
@ -146,6 +183,14 @@ is |
|
|
|
-- Behavioural Specification of F_MM -- |
|
|
|
-- Behavioural Specification of F_MM -- |
|
|
|
--------------------------------------- |
|
|
|
--------------------------------------- |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
procedure Read_Inputs with |
|
|
|
|
|
|
|
Global => (In_Out => State, |
|
|
|
|
|
|
|
Input => (External.From_GS, External.From_CP)); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
procedure Write_Outputs with |
|
|
|
|
|
|
|
Global => (Input => State, |
|
|
|
|
|
|
|
Output => (Output.To_F_CM, Output.To_F_FC, Output.To_F_EL)); |
|
|
|
|
|
|
|
|
|
|
|
procedure Run with |
|
|
|
procedure Run with |
|
|
|
Global => (In_Out => State), |
|
|
|
Global => (In_Out => State), |
|
|
|
Post => |
|
|
|
Post => |
|
|
@ -162,7 +207,16 @@ is |
|
|
|
|
|
|
|
|
|
|
|
and then |
|
|
|
and then |
|
|
|
(if Navigation_Mode'Old = A |
|
|
|
(if Navigation_Mode'Old = A |
|
|
|
|
|
|
|
then Operating_Point = Operating_Point'Old) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
-- Freeze the operating mode once landing is activated. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
and then |
|
|
|
|
|
|
|
(if Power_State'Old = ON |
|
|
|
|
|
|
|
and then On_State'Old = RUNNING |
|
|
|
|
|
|
|
and then Running_State = LANDING |
|
|
|
then Operating_Point = Operating_Point'Old), |
|
|
|
then Operating_Point = Operating_Point'Old), |
|
|
|
|
|
|
|
|
|
|
|
Contract_Cases => |
|
|
|
Contract_Cases => |
|
|
|
(Power_State = OFF |
|
|
|
(Power_State = OFF |
|
|
|
and then Power_Off |
|
|
|
and then Power_Off |
|
|
@ -273,7 +327,7 @@ is |
|
|
|
(if Running_State = CRUISE then Energy_Compatible_With_Mission) |
|
|
|
(if Running_State = CRUISE then Energy_Compatible_With_Mission) |
|
|
|
and then |
|
|
|
and then |
|
|
|
(if Running_State = DESCENT then not Descent_Over) |
|
|
|
(if Running_State = DESCENT then not Descent_Over) |
|
|
|
and then Operating_Mode_Changed |
|
|
|
and then Operating_Point_Changed |
|
|
|
=> |
|
|
|
=> |
|
|
|
Power_State = ON |
|
|
|
Power_State = ON |
|
|
|
and then On_State = RUNNING |
|
|
|
and then On_State = RUNNING |
|
|
@ -284,7 +338,7 @@ is |
|
|
|
and then (Running_State in CLIMB | DESCENT) |
|
|
|
and then (Running_State in CLIMB | DESCENT) |
|
|
|
and then Power_On |
|
|
|
and then Power_On |
|
|
|
and then not Mission_Abort_Received |
|
|
|
and then not Mission_Abort_Received |
|
|
|
and then (if Navigation_Mode = RP then not Operating_Mode_Changed) |
|
|
|
and then (if Navigation_Mode = RP then not Operating_Point_Changed) |
|
|
|
and then (if Running_State = DESCENT then not Descent_Over) |
|
|
|
and then (if Running_State = DESCENT then not Descent_Over) |
|
|
|
and then Cruise_Altitude_Reached |
|
|
|
and then Cruise_Altitude_Reached |
|
|
|
=> |
|
|
|
=> |
|
|
@ -299,7 +353,7 @@ is |
|
|
|
and then not Mission_Abort_Received |
|
|
|
and then not Mission_Abort_Received |
|
|
|
and then |
|
|
|
and then |
|
|
|
(if Running_State = CRUISE then Energy_Compatible_With_Mission) |
|
|
|
(if Running_State = CRUISE then Energy_Compatible_With_Mission) |
|
|
|
and then (if Navigation_Mode = RP then not Operating_Mode_Changed) |
|
|
|
and then (if Navigation_Mode = RP then not Operating_Point_Changed) |
|
|
|
and then |
|
|
|
and then |
|
|
|
(if Running_State in CLIMB | DESCENT then |
|
|
|
(if Running_State in CLIMB | DESCENT then |
|
|
|
not Cruise_Altitude_Reached) |
|
|
|
not Cruise_Altitude_Reached) |
|
|
@ -337,4 +391,37 @@ is |
|
|
|
Power_State = ON |
|
|
|
Power_State = ON |
|
|
|
and then On_State = On_State'Old); |
|
|
|
and then On_State = On_State'Old); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
private |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
procedure Mission_Setup_Management with |
|
|
|
|
|
|
|
Global => (In_Out => State), |
|
|
|
|
|
|
|
Post => (if Payload_Bay_Closed |
|
|
|
|
|
|
|
and then Mission_Parameters_Defined |
|
|
|
|
|
|
|
and then Energy_Compatible_With_Mission |
|
|
|
|
|
|
|
then Boarding_Completed); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
procedure Operating_Point_Update_Management with |
|
|
|
|
|
|
|
Global => (In_Out => State), |
|
|
|
|
|
|
|
Contract_Cases => |
|
|
|
|
|
|
|
(Navigation_Mode_From_CP = A |
|
|
|
|
|
|
|
or else not Operating_Point_From_GS_Received |
|
|
|
|
|
|
|
=> |
|
|
|
|
|
|
|
Operating_Point = Operating_Point_From_USB_Key, |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Navigation_Mode_From_CP = RP |
|
|
|
|
|
|
|
and then Operating_Point_From_GS_Received |
|
|
|
|
|
|
|
and then Power_State = ON |
|
|
|
|
|
|
|
and then On_State = RUNNING |
|
|
|
|
|
|
|
and then Running_State = LANDING |
|
|
|
|
|
|
|
=> |
|
|
|
|
|
|
|
Operating_Point = Operating_Point'Old, |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Navigation_Mode_From_CP = RP |
|
|
|
|
|
|
|
and then Operating_Point_From_GS_Received |
|
|
|
|
|
|
|
and then not (Power_State = ON |
|
|
|
|
|
|
|
and then On_State = RUNNING |
|
|
|
|
|
|
|
and then Running_State = LANDING) |
|
|
|
|
|
|
|
=> |
|
|
|
|
|
|
|
Operating_Point = Operating_Point_From_GS); |
|
|
|
|
|
|
|
|
|
|
|
end MMS.F_PT.F_MM.Behavior; |
|
|
|
end MMS.F_PT.F_MM.Behavior; |
|
|
|